Core concepts
Six resources, one event path
The public API exposes durable resources rather than internal sessions. Resource IDs remain stable across runtime restarts.
Source ──< Monitor ──< Event ──> Evidence
│
├──> Webhook delivery
└──> Incident ──> controlled Action| Resource | ID | Responsibility |
|---|---|---|
| Source | src_* | Stores input configuration, secret reference, and connection state. |
| Monitor | mon_* | Binds a task instruction and inference settings to a Source. |
| Event | evt_* | Machine observation and lifecycle that never requires prose parsing. |
| Incident | inc_* | Human claim, note, tag, and resolution workflow. |
| Webhook endpoint | wh_* | Durable notification destination and event subscription. |
| Delivery | whd_* | Immutable delivery attempt and retry state. |
Events are not incidents
An Event is an analytic observation with raised, updated, and cleared lifecycle states. An Incident is human work created from one or more events. An analytic clear never silently closes a human incident.
Desired state and runtime state
A Source or Monitor's enabled flag is desired state. The runtime separately reports states such as online, degraded, waiting_for_source, waiting_for_model, or failed. Temporary failure never deletes configuration.
All public IDs are opaque. Never infer database keys, file paths, site identity, or time from an ID.